We allow users to access the database through the designated application, for which they are in an AD group with limited permissions, but we don't want those same users accessing the database from Excel, Access, etc. That's why it's set-up this way.